# Abusing Trusted Applications with Nested Execution

Signed Microsoft binary WseClientSvc.exe loads any .NET assembly passed as an argument, letting attackers proxy arbitrary execution through a trusted service.

- Payout: Research
- Severity: medium
- Program: Microsoft
- Write-up by: Huntress
- Disclosed: 2017-10-02
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/abusing-trusted-applications-with-nested-execution
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-trusted-applications-with-nested-execution
- Tags: area:web impact:integrity kind:research platform:threat-intel sev:medium tech:dotnet technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows service host binary (WseClientSvc.exe) from Windows Server Essentials SDK
**Root cause:** WseClientSvc.exe invokes the file path given as its argument via .NET assembly loading, without validating that the target is a legitimate ProviderHost assembly.
**Steps:**
1. Observe multiple services sharing WseClientSvc.exe with a second executable passed as argument.
2. Run `WseClientSvc.exe calc.exe`; error shows it tries to load the file as a .NET assembly.
3. Build a simple .NET pass-through program that invokes its own argument.
4. Run `WseClientSvc.exe passthru.exe calc.exe`; calc.exe launches.
**How found:** While triaging an unrelated Huntress detection, noticed several unfamiliar services sharing one executable with a nested command line; tested passing calc.exe, read the .NET load error, decompiled the binary, and hypothesized a .NET wrapper would satisfy the assembly-manifest requirement.
**Exploitation:** Attacker installs a service (via the Essentials SDK ProviderServiceBase) that uses the signed WseClientSvc.exe as host and a custom .NET pass-through assembly to launch arbitrary executables, appearing as a legitimate signed Windows service.
**Insight:** Signed service hosts that take an executable path as an argument and load it as a .NET assembly are proxy-execution primitives; a tiny pass-through assembly converts them into arbitrary launchers that blend into legitimate service lists.

## Proof of concept (copied exactly from the original report)

**WseClientSvc.exe nested execution of arbitrary binary**

```
WseClientSvc.exe passthru.exe calc.exe
```

**Pass-through .NET program source**

```
Simple pass-through program
```